That still does not clarify what CCP have to do with an invoice from CEL if the contract is with CEL. Simply stating that CEL are acting for CCP is not an answer. If CCP were a trading name of CEL, that would be a different matter but that isn't the case as CCP are an independently registered limited liability company.
Something here doesn’t add up, and the whole situation smells bad.
According to the Notice to Keeper (NtK), it was Civil Enforcement Ltd (CEL) who obtained the Keeper’s personal data from the DVLA and named themselves as the “creditor.” That means CEL are claiming to have the legal right to issue and enforce the parking charge. Only the company with a valid contract from the landowner has that right, or someone authorised by them.
However, all communication from the landowner (Oradent) is with Creative Car Park Ltd (CCP) – a completely separate company from CEL. There is no communication at all between Oradent and CEL. So the question is: why did CEL access the Keeper’s DVLA data if Oradent are dealing with a different company (CCP)? If CEL do not have their own contract with Oradent, they had no lawful reason to get the Keeper’s personal details.
Under GDPR, any company accessing and using personal data must have a legal basis to do so. The usual basis in these parking cases is called “legitimate interest.” But that only applies if the company has a real interest and legal reason to act – such as being the contracted operator. If CEL does not have a contract with Oradent, they may will have accessed the Keeper’s DVLA data unlawfully.
There is another problem. Oradent clearly believes that CCP are handling the parking enforcement. Oradent passed the Keeper’s personal data to CCP to deal with the matter. But if CEL are the creditor and CEL got the data from the DVLA, why does CCP have any access to that data at all? The Keeper did not give permission for CCP to have their details, and CCP is not named on the NtK. If CCP are not the data controller, they have received the Keeper’s data unlawfully from Oradent or CEL.
It gets worse. CCP appear to know that the case has been passed to a debt collector (DCBL). That means either CEL shared the Keeper’s data with CCP, or CCP shared it with CEL, or Oradent shared it with both. In any of those cases, there has been data sharing between separate companies, and it is unclear if any of that sharing was lawful or agreed.
As for DCBL – they are not a party to the alleged contract. If a contract existed, it would be between the driver and either CCP or CEL – not both, and definitely not DCBL. There can’t be a single contract with both CCP and CEL. Only one company can hold the rights under the contract, not both at the same time.
You absolutely must not communicate with DCBL. They are powerless to do anything as they are not a party to any contract allegedly breached by the driver. Never, ever, communicate with a useless debt collector, especially DCBL. Ignore them.
So the GDPR issues are:
• Did CEL have a legal basis to access the Keeper’s data from the DVLA?
• Why is Oradent dealing with CCP if CEL claim to be the creditor?
• Why does CCP have the Keeper’s data at all?
• Was the Keeper’s data shared with DCBL without a proper legal reason?
• Has there been unlawful data sharing between separate companies without the Keeper’s consent or knowledge?
All of this creates a very confusing and probably unlawful chain of data handling.
These are the suggested next steps:
1. Do not communicate with DCBL.This remains unchanged. DCBL are irrelevant. They are not a party to any alleged contract and cannot enforce anything. No replies, no engagement. Ignore them entirely.
2. Send a letter to Oradent.Use the draft response below to put responsibility back on Oradent as land occupier. They are the party who contracted with CCP and/or CEL and are therefore jointly and severally liable for any data misuse, signage failings, or enforcement actions. This makes it clear that the matter is not closed and that you, the Keeper, will not be passed from pillar to post.
3. Hold off on contacting CEL or CCP for now.Since the PCN was issued by CEL but all communication from Oradent has been with CCP, it's unclear who is truly responsible. Let Oradent clarify who they contracted with and who they instructed. If they fail to provide clarity or take responsibility, further action can then be taken directly with the parties involved.
4. Gather evidence from the site.You should still return to the car park and:
1. Photograph all signage (especially terms and conditions)
2. Identify which company is named on the signage (CEL, CCP, or both)
3. Note any mention of how registration must be logged and whether any system failures are covered
This step is important in case a formal complaint needs to be escalated or if legal action is later brought.
5. Keep all communications and evidence organised.Retain copies of:
• The NtK from CEL
• Any DCBL letters
• All emails or letters from Oradent
• The signage photos
• Any notes or records of phone calls This creates a full paper trail in case of escalation.
6. Await response from Oradent before further escalation.Only once Oradent have replied (or failed to do so within a reasonable time) should you consider:
• Making a complaint to the ICO (for data misuse)
• Reporting the matter to the DVLA KADOE compliance team
• Contacting CEL or CCP directly for evidence of contract and data handling justification
• Making a Subject Access Request (SAR) if necessary to all parties
Here is a draft letter you should sent to your contact at Oradent:
Dear [Oradent Practice Manager/Reception],
Thank you for sending over the emails between your practice and Creative Car Park Ltd (CCP). However, I must make it clear that your response is not satisfactory, and I do not accept that this matter has been resolved by asking me to “deal with DCBL.”
To be clear:
1. The PCN (Notice to Keeper) was issued by Civil Enforcement Ltd (CEL), not CCP.
2. All of your communication has been with CCP, not CEL.
3. CEL and CCP are entirely separate companies. They are not trading names of one another.
4. There has been no communication between CEL and yourselves, and yet CEL claim to be the "creditor" in this matter and have obtained and processed my personal data, which raises serious concerns under data protection law.
5. I have never given consent for you to pass my personal information to CCP or CEL, or for it to be shared between them.
6. Despite being informed of the blackout, a PCN was issued. You then confirmed the vehicle was legitimately on site. CCP acknowledged the issue and agreed a “blackout” was applied — meaning no PCNs should have been issued. Yet the PCN has still been escalated to a debt collector.
I must also make it clear that I will not communicate with DCBL, who are not a party to any alleged contract and have no legal standing. They are irrelevant to this matter and their letters will be ignored.
As the land occupier and party who engaged the services of the parking operator (CCP or CEL), you are jointly and severally liable for the actions of any company you have authorised to enforce parking on the land. That includes the wrongful issue of charges, any unlawful sharing of personal data, and the ongoing harassment caused by debt recovery action.
I now require you to:
• Immediately escalate this matter to senior management within Oradent or your head office.
• Instruct CEL or CCP, whichever is responsible, to cancel the charge and to recall the matter from debt recovery.
• Confirm what contractual arrangements exist between Oradent, CCP, and CEL that have led to this confusion and the wrongful issue of a PCN.
• Explain why my data was shared or accessed by these companies without clarity or transparency.
If this matter is not resolved swiftly, I will have no choice but to consider a formal complaint to the Information Commissioner’s Office (ICO) and the DVLA, as well as exploring other avenues to recover any loss or distress caused.
I trust you will treat this matter with the urgency it deserves.
Yours sincerely,
[Keepers name]